ChatGPT Didn't Break the AI Act. It Showed Why Adaptive Regulation Matters

There is a tidy story critics of the EU like to tell about the AI Act: that ChatGPT arrived in late 2022, blindsided the negotiators, and proved that regulators are forever one product cycle behind the technology they try to govern. It is a good story, but it's incomplete.

When the European Commission proposed the AI Act in April 2021, it built the legislation around a straightforward principle: regulate AI according to the risks of its use rather than the technology itself. An AI system used to screen job applicants could create significant risks and therefore face strict obligations. A spam filter would not. The proposal deliberately focused on applications rather than underlying models.

What it did not fully anticipate was the emergence of increasingly capable general-purpose AI models that could underpin thousands of downstream applications simultaneously. The Act's use-based logic struggled to address models whose risks could not be understood solely through any single deployment. The original framework did have a hole, and it was spotted early. In the August 2021 public consultation on the draft Act, we (Future of Life Institute) and other stakeholders warned that the proposal had no answer to general-purpose AI — models that cut across the high-risk categories the Act was built on.

ChatGPT did not reveal this problem for the first time. It made it politically impossible to ignore.

Seen this way, the AI Act's legislative history tells a different story from the familiar narrative of regulatory failure. Rather than freezing the Commission's original proposal, the legislative process adapted as technology evolved.

The first move came under the Slovenian Council presidency in November 2021, which floated the idea that GPAI might need its own treatment, the earliest hint that the use-case structure had a gap. The French presidency pressed the question through 2022 and advanced a proposal to treat GPAI models independently from other AI systems.

By the Council's general approach in late 2022, around the same time ChatGPT was capturing the public imagination, member states had agreed that providers of general-purpose systems should shoulder certain obligations. The political urgency ChatGPT generated shaped what came next: in its June 2023 negotiating position, the Parliament introduced a dedicated tiered regime for foundation models. Those two positions were reconciled in the trilogue that closed in December 2023, producing the layered GPAI architecture: baseline duties for all, a lighter touch for open-source, and stricter rules for models with systemic risk.

The resulting regime represented a significant shift from the Commission's original proposal. Instead of regulating only AI applications, the Act introduced obligations for providers of general-purpose AI models themselves.

Every general-purpose AI provider must provide technical documentation, give downstream developers the information they need, put in place a policy to comply with EU copyright law, and publish a summary of the content used for training. Providers releasing models under a free and open-source license are held only to the copyright and training-summary duties, unless their model carries systemic risk. And the providers of the most capable models, open or closed, must go further still: they must conduct model evaluations and adversarial testing, report serious incidents, and implement cybersecurity protections.

Equally telling is what the Act left unfinished on purpose. Rather than freeze detailed obligations into primary law, it instructed the new AI Office to convene a Code of Practice, a voluntary instrument that providers can use to demonstrate compliance until harmonized standards exist. Nearly a thousand stakeholders took part in drafting it. The Code was published on July 10, 2025, and the Commission and the AI Board confirmed it as an adequate compliance tool. Critics reasonably ask whether a voluntary instrument can carry this much regulatory weight; but whatever its flaws, it is a mechanism for updating expectations without reopening the law.

Now comes the test. The GPAI obligations have applied since August 2, 2025, but for a year they sat without teeth, as the Commission couldn't yet enforce them. That changes on August 2, 2026, when the Commission's supervision and enforcement powers come into force — the power to request information, to evaluate models, to demand mitigation measures or removal of a model from the market, and to fine providers up to 3% of their global annual turnover. Models already on the market before August 2025 have until August 2, 2027, to comply.

Implementation of the law has started to take shape. Most major providers, such as Anthropic, Google, Microsoft, and OpenAI among more than twenty signatories, have signed the Code; Meta declined, and xAI signed only the Safety and Security chapter, leaving it to prove transparency and copyright compliance by other means. A signatory taskforce, chaired by the AI Office, has begun meeting to help industry comply, with enforcement now days away.

The Act did not just create rules; it created an administrative body capable of updating and enforcing them. It set up the AI Office, which is operational and is the sole enforcer of the GPAI rules. It already employs more than 125 people, including technology specialists, lawyers, policy specialists and economists, and is expected to grow towards the 140-plus headcount envisaged when it was set up in 2024. A dedicated AI Safety unit focuses on identifying the systemic risks of the most capable general-purpose models. These are risks that scale to society, such as enabling large-scale cyberattacks or chemical and biological threats.

The Act also built in expertise and interpretation as it went. The Commission has recruited a Scientific Panel of 60 independent AI experts, drawn largely from academia, public research and civil society, and barred from ties to AI providers, to advise on classifying general-purpose models, evaluation methodologies, and to alert the AI Office to systemic risks at Union level.

None of this suggests that the AI Act has solved the challenge of governing general-purpose AI. The effectiveness of the framework will ultimately depend on implementation, institutional capacity, and political willingness to enforce difficult decisions. Those questions cannot be answered until the enforcement regime is tested in practice.

But neither does the legislative history support the claim that ChatGPT simply exposed an obsolete law. The AI Act demonstrates something more interesting. Faced with a significant technological shift during negotiations, European institutions revised the legislation, created a dedicated regime for general-purpose AI, and established institutions capable of refining its implementation over time.

The real test begins now. The achievement was in the adaptation; whether it was enough will become clear after August 2, when the Commission has to use the tools it built.